Security review, handled. Reviews start when the App is installed. Suggested fixes you apply. The whole-repo scan is live and reads access control. Aevral competes with Codex Security as an AI security reviewer for GitHub pull requests. Aevral is not a lab: it runs on open-source models, processed in the US today, with an EU-only option announced. Compare current coverage, access, price, and fix paths below.
Last verified 2026-09-17. Primary sources: Codex Security overview; Codex Security Review; Codex Security cloud FAQ; Codex Security CLI quickstart; Codex Security fix workflow. Review monthly and on known product changes.
| Row | Aevral | Codex Security |
|---|---|---|
| Job | Security review, handled. Reviews start when the GitHub App is installed, then a scan of the repository. Suggest fixes you apply: a finding can carry a suggested diff, plus a prompt for your coding agent. | Find, confirm, and fix vulnerabilities. Repository scans, Security Review on pull requests, and proposed patches with validation evidence. |
| Target coverage | PR review looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks. Whole-repo scans read authorization, IDOR, and business-logic access control only. Not memory corruption, not secret or dependency scanning, not a general SAST. PR review is live on install; paid PR plans are live in the console. | Security analysis using repository context and threat models, with sandbox validation of likely vulnerabilities. Language-agnostic; results depend on the language, framework, and scan coverage. |
| Models | Open-source models. Processed in the US today, EU-only option announced. | OpenAI models by default. The CLI lets users select a model and also documents third-party model providers. |
| Price shape | PR security review, USD per organization per month: Starter $49 (100 PR reviews a month, counted per pull request), Pro $199 (500), Business $999 (3,000, plus a monthly export of the security reviews Aevral ran on your pull requests, with coverage and results, that may serve as supporting evidence for automated security testing in audits (for example ISO 27001 A.8.29, SOC 2 CC8.1), and EU-only processing when it is available), Scale $1,999 (6,500, everything in Business), then $0.99 per extra PR review on every paid plan if the owner chose extras; Enterprise from $4,000 a month by conversation; public repositories free. Whole-repo scan, USD: Public repositories $0 (1 authorized public-repo scan / month), Team $99 / org / month (4 then $29), Business $399 (16 then $19), Scale $1,699 (100 then $17). Enterprise by quote from $3,300 per month equivalent (200 scans and up, $16.50 per scan minimum, annual, invoice billing; not self-serve, console features not shipped). Excluding VAT; scans HT, B2B. | Security Review uses no ChatGPT credits during its introductory period; usage limits may apply. CLI scans report estimated model usage costs. Check current account terms for cloud scan pricing; no fixed per-scan price is stated in the cited docs. |
| Seats | No per-seat. Priced by organization. No floor to start. | Security Review access depends on a ChatGPT Enterprise, Business, Edu, or Pro account or workspace; Plus is excluded. CLI scans require Codex Security access. These are account entitlements, not an organization-priced scan allowance. |
| Where it runs | GitHub App and console. PR review, live on install, posts an advisory Check and finding comments. Scans report through a GitHub Check. Paid PR plans are live in the console. | Security workbench in the ChatGPT desktop app, Codex plugin, @openai/codex-security CLI and TypeScript SDK, and cloud scans of connected GitHub repositories. Security Review posts findings on GitHub pull requests. |
| Fix path | Suggested fix as a prompt you copy into Claude Code, Cursor, or Codex. Copy fix prompt. A finding can also carry a suggested diff you apply. No auto-applied patches; Aevral never applies or merges the fix. | Proposed patches with validation evidence. In the workbench, review the generated diff before applying and verifying it. Cloud findings can become a GitHub pull request; cloud scans do not auto-apply repository changes. CLI patching is explicitly requested. |
| Data / trust | Family trust center at trust.ismscopilot.com. Better ISMS is getting ISO 27001 certified. Intended scope includes Aevral. We are not certified today. Aevral is not a product certificate. | Cloud analysis and validation use temporary isolated containers. Security Review comments inherit the pull request's visibility. Local scans use local OS permissions; saved artifacts may contain source code. Review OpenAI's terms and your workspace settings. |
| Availability | Self-serve for PR security review and whole-repo scans. Install the GitHub App, then sign in to the console with GitHub; it connects the install automatically. PR review is live on install; paid PR plans are live in the console. | Cloud scans and Security Review are in research preview. Security Review: Enterprise, Business, Edu, and Pro. The CLI package is public, but running scans requires Codex Security access; some full-repository scans may also require Trusted Access for Cyber. |
Aevral is not affiliated with, endorsed by, or sponsored by Anthropic or OpenAI. Claude, Claude Security, Codex, and Codex Security are used nominatively to identify the products we compete with. No Anthropic or OpenAI logo or trade dress appears on this site.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.